Create a personal Keep key, give each agent a named connection, or limit read-only access to Items with a tag or collection.

Keep has three credential types. Use the type with the least access that your client needs.

Type	Use
Personal key	Your own CLI, scripts, and account administration
Connected client	One named AI agent or other read-and-write client
Read-only key	A client that only reads Items and related library data

Manage keys in Connection settings.

Create a personal key

A personal key has full access to your Keep account.

Open Settings.
Open Connections.
Find API and agents.
Create the personal key.
Copy the key.

Keep shows the full value once. Store it in a password manager or secrets manager.

Send it as a Bearer token:

curl https://keep.md/api/me \
  -H "Authorization: Bearer $KEEP_API_KEY"

Roll the personal key when you need a new value. The previous personal key stops working at once. Connected clients and read-only keys stay active.

Connect an agent

Give each agent its own named connection. The trusted connection name appears in Note revision history.

keep login claude-code
keep login claude-desktop
keep login codex

Each command shows a short code and opens Keep in your browser. Approve the requested access there, and Keep stores the new credential for that client.

A connected client can read and write:

Items
Notes
tags
collections
Projects
highlights

It can also read account details. It cannot create or revoke credentials. It cannot manage webhooks.

See Connected agents for the shared-library and conflict rules.

Revoke a connected client

Use Connection settings, or run:

keep auth remove codex

Revocation takes effect at once. It does not affect other clients or remove the Notes and revisions created by that client.

Create a read-only key

A read-only key can read Items, tags, collections, Projects, and highlights. It cannot access Notes. It cannot save, update, archive, or delete content.

Choose one scope:

all Items
Items with one tag
Items in one collection

Open Settings.
Open Connections.
Find API and agents.
Select New read-only key.
Choose the scope.
Enter an optional name.
Create the key.
Copy the key.

Resource-scoped keys cannot access Notes. Use a connected client when an agent must work with Notes.

Roll or revoke a read-only key

Roll a key to replace its secret without changing its name or scope. Revoke a key to remove its access. Both actions take effect at once.

Use a key with the CLI

Ordinary CLI use does not need a key. Run keep login to sign in through your browser instead.

Keys are for scripts, servers, and integrations. Store one for normal CLI use:

keep key YOUR_API_KEY

Use one key for one command with --key, or set KEEP_API_KEY in the current environment. Use --client <name> to select a named local connection.

Protect every key

Treat a key like a password.
Do not put a key in source control.
Use environment variables or a secrets manager.
Give each client a separate connection.
Revoke a key when it might be exposed.
Use read-only access when write access is not required.

See the API reference and CLI guide for request examples.

Create and manage API keys